With reference to FIG. 1, a vehicle is driven by a drive system. The drive system includes an engine 8 for powering a set of wheels. Modern drive systems include a degree of computerised control. A drive system including computerised control may be termed a ‘drive-by-wire’ system due to there being no direct mechanical link between an accelerator pedal and the engine 8. Instead, the drive-by-wire system includes a computer operatively located between an accelerator pedal and the engine to control the engine based on the position of the accelerator pedal.
In-use, the driver of the vehicle controls the speed of the vehicle by changing the position of the accelerator pedal 12. The system may also include a drive mode selector 14 in the form of a hand operated lever, or the like. Different positions of the drive mode selector 14 correspond to different driving modes, which driving modes may include ‘sport’ and ‘economy’.
The accelerator pedal 12 position and drive mode selector 14 position are monitored by a controller 16. Various transfer functions are provided in the controller 16, each transfer function corresponding to a different driving mode. The controller 16 changes between driving modes in response to the drive mode selector 14 changing position. Each transfer function generates a torque demand based on the accelerator pedal 12 position.
However, various controller errors can occur which will produce inaccurate torque demands. Such inaccuracies could lead to excessive or insufficient engine torque for a given accelerator pedal 12 position. In an attempt to minimise such inaccuracies, a verification module 18 can be provided to verify the accuracy of the torque demand generated by the controller 16.
A typical verification module 18 uses both the drive mode selector 14 position and the accelerator pedal 12 position as inputs. The verification module 18 also monitors the actual torque demand generated by the controller 16. An expected torque demand 20 is generated by the verification module 18 independently of the actual torque demand 22 generated by the controller 16. In this way, the verification module 18 can compare the expected 20 and actual 22 torque demands and calculate an error 24. The error 24 can be used to limit 26 the torque demand in response to an error 24 being unsatisfactory. In this way, any errors in the actual torque demand will not cause unsatisfactory effects such as excessive torque being produced by the engine 8.
The verification module 18 must be of a higher level of integrity than the controller 16 so as to only detect real faults in the actual torque demand 22 and also be robust to false detection. In order to accommodate the increased level of integrity, the complexity of the verification module 18 is reduced compared to the controller 16, otherwise the vehicle would require an extremely expensive, complex, and highly powered computer to run. However, even a verification module 18 of reduced complexity is not ideal since developing it independently to the controller 16 would still require overly detailed knowledge of the actual controller design. In addition, any updates required to the controller 16 in service, for instance the modification of a particular transfer function associated with a drive mode, would require updates not only to the controller 16 but also to the verification module 18.
It is an object of the present invention to address at least some of the disadvantages associated with the prior art.